Bug 10016

Summary: SelfCheckTimeout not logging patron out
Product: Koha Reporter: Nicole C. Engard <nengard>
Component: CirculationAssignee: Bugs List <koha-bugs>
Status: CLOSED FIXED QA Contact:
Severity: critical    
Priority: P5 - low CC: brendan, eveal, gmcharlt, kyle.m.hall, tomascohen
Version: Main   
Hardware: All   
OS: All   
See Also: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=10009
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: bug 10016: munge history in SCO to discourage resubmitting user login
Bug 10016: force zero browser-side caching of SCO pages
bug 10016: munge history in SCO to discourage resubmitting user login
Bug 10016: force zero browser-side caching of SCO pages
bug 10016: munge history in SCO to discourage resubmitting user login
[SIGN-OFF]bug 10016: munge history in SCO to discourage resubmitting user login
Bug 10016: force zero browser-side caching of SCO pages
Bug 10016: force zero browser-side caching of SCO pages
[SIGN-OFF]bug 10016: munge history in SCO to discourage resubmitting user login
[PASSED-QA] Bug 10016: force zero browser-side caching of SCO pages
[PASSED-QA] bug 10016: munge history in SCO to discourage resubmitting user login

Description Nicole C. Engard 2013-04-09 17:00:12 UTC
Received via email:

---------------

I also just discovered that the system preference SelfCheckTimeout which says
it's supposed to "Time our the current patron's web-based self checkout system
login" after a certain number of second only really returns to the self-check
login screen. It's still possible to navigate back, see previous patron
checkouts and check out items.

-----------

Found in Koha 3.10.3
Comment 1 Owen Leonard 2013-05-10 13:20:22 UTC
Confirmed in master.
Comment 2 Galen Charlton 2013-10-20 14:37:56 UTC
Telling the browser not to cache self-check pages should resolve this
Comment 3 Galen Charlton 2013-10-20 14:54:14 UTC
(In reply to Galen Charlton from comment #2)
> Telling the browser not to cache self-check pages should resolve this

It does already use a no-cache Cache-control directive; some preliminary testing indicates that adding max-age=0 to the cache-control directive should do it.  Working on a patch.
Comment 4 Galen Charlton 2013-10-20 21:22:38 UTC Comment hidden (obsolete)
Comment 5 Galen Charlton 2013-10-20 21:22:58 UTC Comment hidden (obsolete)
Comment 6 Galen Charlton 2013-10-20 21:23:09 UTC Comment hidden (obsolete)
Comment 7 Ed Veal 2013-10-20 22:46:20 UTC
I tested this bug in both Chrome and Firefox 24 (on a mac). It worked in Chrome but in firefox I got the following error when doing step 4 of the test plan. 

http://edveal.test.bywatersolutions.com/cgi-bin/koha/sco/undefined

An error has occurred
Error 404

    This error means that the link was broken and that the page doesn't exist.
    To report this error, you can email the Koha Administrator.
    Return to the catalog home page.


Ed
Comment 8 Galen Charlton 2013-10-20 23:00:53 UTC Comment hidden (obsolete)
Comment 9 Galen Charlton 2013-10-20 23:00:59 UTC Comment hidden (obsolete)
Comment 10 Ed Veal 2013-10-20 23:10:06 UTC Comment hidden (obsolete)
Comment 11 Ed Veal 2013-10-20 23:14:41 UTC Comment hidden (obsolete)
Comment 12 Ed Veal 2013-10-20 23:16:34 UTC Comment hidden (obsolete)
Comment 13 Ed Veal 2013-10-20 23:16:43 UTC Comment hidden (obsolete)
Comment 14 Brendan Gallagher 2013-10-21 00:05:12 UTC
Created attachment 22140 [details] [review]
[PASSED-QA] Bug 10016: force zero browser-side caching of SCO pages

This patch makes the web-based self-check module pages
specify that no browser (or proxy caching) occur at all.
This prevents a security issue where letting the SCO session time out,
then hitting the back button allowed one to view the previous
patron's session.

This patch adds an optional fifth parameter to output_with_http_headers(),
and output_html_with_http_headers(), a hashref for miscellaneous
options.  One key is defined at the moment: force_no_caching, which if
if present and set to a true value, sets HTTP headers to specify no
browser caching of the page at all.

To test:

[1] Start a web-based self-check session and optionally perform
    some transactions.
[2] Allow the session to time out (it may be helpful to set
    SelfCheckTimeout to a low value such as 10 seconds).
[3] Hit the back button.  You should not see the previous patron's
    self-check session.
[4] Verify that prove -v t/Output.t passes.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Comment 15 Brendan Gallagher 2013-10-21 00:05:21 UTC
Created attachment 22141 [details] [review]
[PASSED-QA] bug 10016: munge history in SCO to discourage resubmitting user login

This patch uses history.replaceState (introduced in HTML5) to manipulate
the browser history to encourage returning to the SCO patron barcode
form if the back button is used.

Note that a side effect of this patch is that if the user uses
the help link, they will be prompted to enter their barcode
again.  It may be better to put the help inline with the rest
of the SCO forms.

To test:

[1] Start a web-based self-check session.
[2] Enter a patron barcode.
[3] Allow the self-check session to time out.
[4] Use the back button.  You should get the patron barcode
    entry form; you should not be prompted to resubmit form input.
[5] Enter a patron barcode, perform some transactions, then
    use the finish button.
[6] Next, use the back button.  You should get the patron barcode
    entry form.

Signed-off-by: Galen Charlton <gmc@esilibrary.com>
Signed-off-by: Ed Veal <ed.veal@bywatersolutions.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Comment 16 Galen Charlton 2013-10-21 18:06:24 UTC
Pushed to master.
Comment 17 Tomás Cohen Arazi 2013-11-20 16:44:26 UTC
This patch has been pushed to 3.12.x, will be in 3.12.7.

Thanks Galen!